Re: [radext] Short draft on using larger packets for TLS fragmentation

Sam Hartman <hartmans@painless-security.com> Mon, 08 July 2013 16:25 UTC

Return-Path: <hartmans@painless-security.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BEDB21F938E for <radext@ietfa.amsl.com>; Mon, 8 Jul 2013 09:25:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aB39JbhWN2P2 for <radext@ietfa.amsl.com>; Mon, 8 Jul 2013 09:25:14 -0700 (PDT)
Received: from mail.painless-security.com (mail.painless-security.com [23.30.188.241]) by ietfa.amsl.com (Postfix) with ESMTP id 37C0221F8925 for <radext@ietf.org>; Mon, 8 Jul 2013 09:25:13 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.painless-security.com (Postfix) with ESMTP id E4C6320181; Mon, 8 Jul 2013 12:20:32 -0400 (EDT)
Received: from mail.painless-security.com ([127.0.0.1]) by localhost (mail.suchdamage.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZiDyD2qCjHgz; Mon, 8 Jul 2013 12:20:31 -0400 (EDT)
Received: from carter-zimmerman.suchdamage.org (unknown [10.1.10.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.painless-security.com (Postfix) with ESMTPS; Mon, 8 Jul 2013 12:20:31 -0400 (EDT)
Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id 6DE3188420; Mon, 8 Jul 2013 12:24:28 -0400 (EDT)
From: Sam Hartman <hartmans@painless-security.com>
To: Peter Deacon <peterd@iea-software.com>
References: <tsly59hu6n8.fsf@mit.edu> <alpine.WNT.2.00.1307072023550.3140@SMURF>
Date: Mon, 08 Jul 2013 12:24:28 -0400
In-Reply-To: <alpine.WNT.2.00.1307072023550.3140@SMURF> (Peter Deacon's message of "Mon, 8 Jul 2013 08:46:23 -0700 (Pacific Daylight Time)")
Message-ID: <tslsizp3tqb.fsf@mit.edu>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.4 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Cc: radext@ietf.org
Subject: Re: [radext] Short draft on using larger packets for TLS fragmentation
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Jul 2013 16:25:21 -0000

>>>>> "Peter" == Peter Deacon <peterd@iea-software.com> writes:

    Peter> On Sun, 7 Jul 2013, Sam Hartman wrote:

    Peter> Section 4.2 provides for larger messages via TCP and
    Peter> communicating message limits.  It's not even necessary to
    Peter> support 4.2 command code and attributes to communicate
    Peter> message limits.  Support for large messages is allowed to be
    Peter> an administrative option provided it is not enabled by
    Peter> default.

Yeah, I was taking 4.2 out of your draft as inspiration.
I agree my approach does not of itself give UDP interop.
However, this approach works well either with your approach or Alex's
approach, but seems to be close enough to WG agreement that we might be
able to move on it this year.
Once we get consensus on a broader solution I think it can fit in.

I don't promise to use the same framing as your section 4.2, but your
contributions to this discussion particularly in that section are very
much on my mind in terms of what we're trying to accomplish.

I'm trying to separate out what we seem to have agreement on so that I
can start shipping code.